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ABSTRACT 


exploration of space teyondM^i^S ® L^hT ^P 3 *^ 00 of humans in the 
mission 10 Mars'. TteJ missio^^Sa “* <° * ”*™d 

^S'„° f my CUmm POSid0n - *• M “^ of NASA's £Zg£*f "" 


will be ^^She^Sdy^y autoiS^Ts^tOT^^t^ te Vcry . fcw activities or missions that 
humans for Z critical decisi^ “volvemenL We will rely on 

reliable, and effective performance ofthesoacf ^ hn^ human resource to ensure safe, 

must be an integrated man-machine relatiimWp^h^ i^^hili^ Mar ?P^ n n cd 'S p aces hi p entity 
needs, as well as the physical capabilities and lirnifnt!I!I^ d ^fP^^hihues in which the psychological 
constraints in the total system design The audSit^nd ’ f ** hj®? 81 * must be considered as fixed 
with the crew, bn, we wrU^exfSSd f " mi ^ 0 ?. su “ e » 

Its task. F P C mc “"“y of ™ c total human-machine sy^m t0 perfonn 




systems in aviation. We now have advanced svsteml ZaaI- “«=^anng numans and comparable 

virtually full automatic flight from S5J22225J3? dcv ? c f s ° nboard our modem aircraft that perm 
and decreased flight crew workload. Generally these hieh level 3 ^ ng roUo V t ’ ^th increased precision 

— — w«sss snssssaaKess-saa 

v \r~ i i j i . - 


— v^vi«*wio OilUfllL 

system. oSex^Sc^A auto^on indirato SSt its tomSiS* t ?, rcm ? vc human error from the 
nature and consequences of human error wh% u ^ rcIo ««es and changes the 
created through automation can in fact be worse lL <- no wknow that the new errors 

The evidence of problems of human interactions with advan^f wors alleviated through automating. 

FAA's new National Han for S™ bccome 80 O'"** that d» 

development of "humatHrentered" desi en frr autnnutfrvi -J?T S ^^ est Pjonty to encouraging the 
for evaluating human factors issues as of every major ir^£ S!^!. <fe velo| ’ mCTI rf P ro< * dure8 


^'iviTKSgS °s^S d s rr ad0n “ d ^ •“ hlm “ s permeate the 
planetary rovers; surface operations; extravehicular rctivitv airi as f cmbl y and construction; 

and preservation; and scientific probes Si renetrators ^We^ cr^toratiOT; sample acquisition, analysis, 
vrnety of systems in which a n£ of * 

producing a symbiotic integration of the powers of t ho to . woric together as partners, 

have little a PI ieciation of e^er the^ *“ "“i^mputers. Unfortunately, we 

humans and inteUigent niachm^^howZ^^^! of close working relationships between 

torn! crew performance. We do not know how to design m^c^Tw^u " 
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will fit naturally into a human organization. Wedonnt at rh* ♦; u . . 

methodology for system design by which the develorv^nf rh* have a raDonal > predictive 

“ssstThrssar? 1 " - -^Srassss sssr 

based on 

inadequate. The classical dStaSto to ,0 

some task, and the human-operator aspects of contmlliiJ thic ™ ? >me ^ 1)660 devel oped to do 

been dealt with in due coursT The hu^infS^n ^^ 30(1 of **“8 trained to do so have 

adaptive mapping th* SS'the SS^iS2? inm rK^ COntroIs , has 5660 «»d as an 

been carried over into the designs of the most advanced a P p *?P natc con .H^ actions. This concept has 

exploit that which is technologically feasible leaving tft s ^, stei ? s - 1,35 been a tendency to 

escaped automation, together with whatever new tasks arc een^rS^TV °? rcmai ™ g tasks whlch have 
enable us to design machines with assume WlU " CTer 

7““* “ d **«■“ *— based on 

interactions, and not the individual behaviors The design ls , con ^ erned with optimizing the 

human-complementary, human-interactive svstem Tn rKk nW 1 i° S ° I> k y 1 S u baS f^ ° n . a conce P t °f building a 
men and machines &TalSSS SS w^ P &i?;h? , l al ^ :a,,0n °S bcIW “" 

by men and machines working together in a oannershm dun iS a b? u ! a •** that can be done 

^^OTMnce!^ * ind ^^ duaJ ^^<i^k nn^mmce^jjn^jent atS rf^tive^am or^stem'^ 0 " 11615 ’ 
^5S^Sy > ^ta^d«iSr?Ei? S?8n P^hy^uman-machine interaction is 

system design, but the b 

capable of mdepenSndteW^^ EmtamdSnch° nna<i0n ^ -processing systems 

necessarily involves understanding Se SSridSS; ^^^ g f ^T‘ COmp “ t=r ™»»*» 
mote conile* pmc esses tesnltinE' of.^emdono/both parties as well as the even 

on computational modelling of hSman perception aiid co^StiSl^ e^fclSf^dSri^l^ 1 rcSearch 

of our computational models enables us to begin to con^id^r j 

intelligence. With their continued develoomES and ^^i^Eh^c ^ E^ET!lvt , 

S i^stems ClOP gU,delinCSf0rdCSignS m 
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L iNTRonrrrTifirc 

wh^ S U Almost 

inevitable next giant step ' SUrfa “ ofM ^“^e May. It is the 

SwS,°i k h fa lunar landi,,g - PrKid 'nt 
and Mars. The implercnation of this pSidSSw££ th^uman exploration of the Moon 

the Space Exploration Initiative or SEI The SFT uriii mnutme H| ls NASA’s program called 
in the exploration of space beyond * c Pupation of humans 

leading to a manned mission to Mars. U ^"2 wth a Lunar-base and eventually 

from Earth wiAout^j^j^ for we ^ py CT a year, isolated 

low-Earth orbit, the e££ L-L IaSS w*" 1 a F* ** hunch 

Moon seen from Earth. A coupkof^nonths out, tiwE^th^tilfh^ **!“ does thc 
passes across the disc of the Sik £? y bla ? k 51501 “ « 

with transmission delays of several minutec Th#» h*i« k ^ art ^ ^ VC D ^convenient 

;^a=SS' i “* 

Cooped up in tiny noisv Quartern with nth ^ re c. « , ® dangers or crisis situations. 

mthSh defeSta ^ “ 5° «“**• «* ““non 

space experiments have all shown effects of hJKSK.flr US and Soviet manned 
depression, insomnia, hostility, boredom, and “l** 5 forms of a Pa%. 

fear produces a temporary loss of perceptual aei.S^StHI decbn ? of motivation. Intense 
nmrowing of attention Sd l£g, of p^d a 

inefficiency in information La th EffSts SS consequences, and 

will influence group functioning it rnSS 7 angle member of a group 

survive such afourSey, Sss iS^S^e^ *“ 

must arrive at their destination in good physical ’ r 42 ” v °y a gers 

the 1/3 gravity of Mars after 8 months of ^ condmon ready to go to work in 
from the local inhabitants. (Refl) ^ essness ^diout any hope of assistance 
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and SSS? s” hTrtsston^Tth^h ab °“‘ the P fe‘ 0logica1, Psychological 
ensure their safety, reliaSy, T" bef ° rc wcwmb ' ablets 

one small, but very significant. Darfnf rhic S ecturc ’ * P ro POse to address only 

the systems with wMchT otw S if ^ ' “fj '™\ ’ “concerned about the design of 
extraordinary missions. I a^con^rL^K^ mteract ! n order to perfonn these 
Human Factors of Space Exploration I have^snrS/? 16 Man . ager of NASA's Project on 
the crew's safety and productivity The pureose of thif J* 1 *?? 31 responsibility for 
perceptions of some of the issues confronting the <L^e^7fU° ““rfF” ° f T ^ CTSOnal 
humans will be required to interact Darticnlariv S ?^ e of niachmes with which 
that might be considered as "intelligent" As I do non^em haVC certain attributes 

when applied to machines, I prefe/to speak forth? r?Sf Pt ? C C ° l |V lotatlon of intelligence 
various degrees of automation rather than intAiu most part m this presentation, of 
viewed as exhibiting some aspect of intellieenre ^ ^ automation might be 

quite different from * « ™=hine "intelligence” is 
to the other. gCC ’ 311(1 u serves no purpose to try to relate one 

h, space independent of 

very few activities that will be accomplished pnrin.ivT S autonomously. There will be 
human involvement T^eM^^S by autonom °us systems without 
machine relationship of shaSS ^fa^ * “ ***** 

mission success will reside with the P crew but we ^ 01 authority and responsibility for 
the total imman-rnachine system to perfoim its task. x P ected to P rove die ability of 

? r the SH j— ta- - hugely 

aviation. The demands of the aviation svstem ^““5 3,1(1 comparable systems in 
now take for granted. (Ref 14) I do no/imend « 6 mot3Va ted much of the automation we 

aircraft flymg^X tatSSSS *„*? "1™^ ca P ab1 ' 
technological leadership Human ^ f adlQonall y look to aviation for 

design of spacel^reS'byS^g^eTs^SeSiT mUCh to A retevaM “ 
modem cockpit design and operation^ aviation 7^perim £. eIopments . and the problems of 


U. YESTFRna y 

SSSa&r-fisat 

the human perceptual capabilities werem^ as long as 

operate the system reliably Things started to rh*n J* ^ }^ ortnatxon he needed to 

aircraft during the late '40's 2S 7W S dX3 ? atlCalJy m . <»* mflitai y fighter 
of missions each of which had become 3ircra ^ t wer 9 assigned a greater variety 

were required to make flying the higher-sDeed . C0Et ?P lejc * Automated devices 

displays to enable the pilot to moS dieh^SS^^i?’ bUt t 5 CSe rw I. u ? ed “ore 
to be presented re the pilot to enable him to Ue the d£uSS 
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mcreased while, at the same time, the number ofirmr^ 0 ^^ 

decades, electro-mechanical instruments switche^^r?*!? Ulcreascd * ° ver *e next few 

cockpit, filling all the available space. uiifortu^ateir^'Sft?^^ “ die 

Jcp t for displays diminished. Formirnn,irtk^^_ “ d 


X F 

the space 


dilemma was to replace the task-SDecifir Hioniatc^ codcpi . t designer s solution to his 
and multi-function controls. This rol ved ^?di multi-purpose displays 

computers that were brought aboard to drive fhS3!? y problem, but the 

more data than a human could possibly twssand Sdh Ci f ablc of Presuming far 
began to make full use of that capabSi^ Se F T*”' 1 de ?S nm 

favoore examples of the data overioad^duc^^l^Sto 2? 

f d “P ^Play. There are 675 
cathode™ tubes. 3teSa?» “ f0Ur d ! ffere ? t “as.™ any of the three 

lights, and 6 warning tones (no messages iust fonesl c ?? lio ” •■“hcaton, 59 indicator 
throttle, 7 on the stick, 19 controls on fhe ’ 10 ™H Itl ‘ fiinctlon switches on the 

controls around the ^riphe^Sf wch ^ ^ *£*** display, and 20 

multi-switch capability. Most of the data disnlaved _J^' ra y ^bes, each of which has a 
engaged (while peripheral vision a valuable^mmnllS^If 68 *0* ^ Pd ot 's foveal vision be 
largely ignored)^ Ever, piece of * 

displays requires an additional control to acres^ThS ** ““to'PU'Pose 

to access the desired data and how to DerfoiS requires the pilot to remember how 

Often, these controls must be SZtJS^Sih^S^ Actions. 

engaged elsewhere, sometimes during momSteof eS^mp'^h 16 * c , pil 5 t ls dually 
Concomitantly as not all of the infZ^ T °t extreme physical and mental stress 

a. aU times, te ^ pilot 
reminded the pilot to take actions call attention tn JL * ^ CT ^jP^ systems. These systems 
or demand an action, wam a ofunatmMta^co^uimd™w >I fu*d 0m ex Pf cle< * faogcaf suggest 
own. Voice and other aural displays and eve2 225^2^’ Md cvc ” ^ 3011011 on their 
to increase the number of physical channels av^iShf ^P^ys were mtt oduced in an attempt 
However, we learned dwffiStoS 

human's information processing canabilitv ^2?? mod abty does not double the 
operator at a critical time In fact, the o U may cv ?° m ^ )c ^ e k by distracting the 
information regardless*^ th« mc^^^b^^e^m^^ndeifif'^h 1 ' 6 °^ add * d ° na ^ 
to narrow their attention. To make matters worse^K,\m^ hl | h " stI ® ,s conditions, tend 
situations is ,0 sec wha, ha expects SS 

seldom communicated with one aether The h ^ <i ? sl ®' le ^ 111 separate departments that 
was used as an ^ yS a " d “" TOls 

control actions. While the (Solav mtei Preted [displays mto the appropriate 

lighting, viewingan^flumSMce^onoast ^ ^ 

r^rca 

sssasf" for au,omadon “ d ,o 


technology for 
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Neither was paying much attention to the informational needs or the perceptual and 
cognitive limitations of the pilot Consequently, problems at the human-machine-systems 
level were discovered only during operation or, at best, during flight test or man-in-the 
loop, ground-based simulation late in the system development 6 

We found that the electronic display systems we provided to aid the pilot sometimes were 
not helping at a 11, and were actually complicating his job. The pilot was frequently being 

SS T *** m formats f at werc not conducive to rapid^teipretotio/ 
and integration, and whose access imposed a memory load. Some applications of 

computer mterface technology resulted in increased demands on the slow, deliberative 
capacity-limited human cognitive processes rather than in engaging parallel, automatic ’ 
pereeptual-recogmtion-based processes. The pilot was often dSvSifrig in data much of 
winch may be essential to his survival, but was starved for information. Unfortunately 
most of these technological advancements in automation and displays, and their 7 
concomitant problems, were not confined to the cockpits of military aircraft: they also 
appeared on the flight decks of commercial air transports, in submarines, nuclear power 
plant control rooms, battle command and control centers, space launch and mission control 
centers, ana, even, in surgical operating rooms. 

It may still come as a shock to some designers (although it should not surprise this 
audience) to leam that the human-machine performance, and the Cooper-Harper ratings 

T at? by . cha "J e ^ m designs of either the displays qc the controls. (Ref 2,3) 

Lebacqz and Aiken showed that there exists a trade off between control augmentation 

f°™Pk. xlty dtsp^y presentation sophistication, and that the trade off isafunction of the 
task being performed. Furthermore, (with all due credit to my good friends George 
Cooper and Bob Harper for the admirable original intent of their rating system) pilot 

niimra Cooper-Harper ratings cannot be used to design systems because the 

pilotcannot, and should not be expected to, identify the particular feature of the display- 
control system to which he is reacting. From the point of view of the human in between 
the issues of displays and controls are not separable. 9 


u ” ews Le “ Br Na V1394 on ,,General Rul « to be Observed at all 

U.S. Flying Fields said do not trust any altitude instrument". We have come a long way 
to an era when on-board computers automatically execute precise vertical navigation 
maneuvers. Today, computer technology has made possible levels of automation which 
ted u, n \ y m ^ ciencc fictlon a short time ago. The modem aircraft is heavily awnmat^ 
and multiple color computer screens m the "glass cockpit" on the modem flight deck show 
maps, instrument readings, and even procedures. 

Before going further, let me clarify a current confusion. The term "glass cockpits" is often 
used interchangeably with automation when, in fact, they are not synonymous. The 
widespread use of cathode ray tubes (CRT) on modem flight decks to replace the array of 
electro-mechanical gages and dials has led to the use of the term "glass cockpit”. However 
conventional instruments have been converted to computerized displays on CRTs without ’ 
necessarily introducing any changes in the degree of automation. Also, autopilots of one 
son or another have been introduced into aircraft without any significant changes in the 
displays. In fact, the first concepts for autopilot control were proposed before the Wright 
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brothers flew. In 1891, Hiram Maxim patented a gyroscopic "stability au gme ntation" 
device that was meant to adjust the flight surfaces of a flying machine. 

The Flight Management System (FMS) which first marie its appearance about ten years 
ago, incorporates an entire flight plan and replaces the reams of navigational charts that are 
needed to cross the continental US (although the paper charts are still carried on board in 
case of computer failure). Advanced systems and devices on board our modem aircraft 
now permit virtually full automatic flight from shortly after takeoff through landing rollout, 
with increased precision and decreased flight crew workload. Moreover, these high levels 
of automation and "glass cockpits" have been well received by the piloting community. 

Results of a supey of over 1400 pilots and engineers conducted recently by the RAF 
Institute of Aviation Medicine revealed enthusiasm for the advanced anmmawi flight decks. 
(Ref 4) The pilots generally said they liked flying them, they were less tiring, and they 
were "controlling" and not merely "monitoring" or "managing" the amnmatitri syste m 

However, we have not yet accumulated sufficient experience to praise or condemn with 
assurance. These new aircraft are designed to work best "hands off" during no minal 
operations, and they are excellent in this mode. It is only when the pilot must talrr over in 
off-nominal situations that human factors issues ever come to light; but, th esn systems are 
designed to very high standards of reliability. Off-nominal situations due to system failures 
are rare, and most of the pilots who responded to the questionnaire never encountered one. 
Nevertheless, a number of incidents have already been reported that give us cause to take 

another look at the human-machine interactions of these modern airaaft (Ref 5) The 
source of much of our information is NASA's and the FAA's confidential Aviation Safety 
Reporting System conceived over 15 years ago by my colleague at Ames, Dr. Charles 
Billings. (Ref 6) 

We have learned from these reports that the introduction of automation has had 
unanticipated effects on human performance and has introduced new kinds of system 
faults. We have found that automation usually relocates and chan g e* the nature and 
consequences of human error, rather than removing it Despite the aerospace industry's 
success at developing ever more sophisticated and reliable technology, the percentage of 
hum an -error-related incidents and accidents has remained remarkably constant (Ref 7) 
Recent figures from the FAA attributed 66% of air-carrier accidents, 79% of commuter fatal 
accidents, and 88% of general aviation fatal accidents to human error as a ca us al factor 
However, it is only fair to point out that the human who erred was not always one of those 
on the flight deck; he may have been on the ground at the time or back at his plant where 
he designed the aircraft 

Several accidents, and a large number of reported incidents, have been associated with, and 
in some cases appear to have been caused by the interaction between automation and the 
human operators of aircraft Flight crews have ignored (or have been unaware of) 
important instrument readings such as fuel levels, have failed to hear wa rnin g devices, have 
deviated from basic operational procedures, have shut down the wrong engine or thrown 
the wrong switch, have failed to coordinate crew activities, have apparently become totally 
disoriented, and have continued to rely on the autopilot when it clearly was not operating 
properly. Automation has acted in ways not expected or desired by the pilots. In some 
cases, automated configuration warning devices have failed or been rendered inoperative 
and flight crew procedures have failed to detect, by independent means, an unsafe 
configuration. In other cases, automation has operated in accordance with its design 
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specifications, but in a mode incompatible with safe flight under particular circumstances. 

In still others, automation has not warned, or flight crews have not detected, thar the 
automation was operating beyond its design limits or unreliably. 

We have also received reports of incidents from commercial aviation that have been 
identified with too little workload in some phases of flight to the point of complacency lgrfr 
of vigilance, and boredom. Others have been associated with too much workload in off- 
nominal situations, particularly when the automated systems call for increased head-down 
operanons during these times. 

TTie computers introduced between the aircraft's state sensors and the displays and between 
the pilot s inputs and the highly automated control surfaces of the aircraft serve to obscure 
the pilot s image of his aircraft Previously, displays and controls were both directly 
coupled to the aircraft so that the pilot was able to construct the mental ‘ma ss of the aircraft 
state directly from displayed responses to his control inputs. Today, engineers can easily 
and inexpensively incorporate logic into the airplane itself; but the computers introduce (by 
design or otherwise) dynamic mappings of their own so that the pilot is no longer able to 
relate the displays directly to the aircraft state or his control inputs to the aircraft’s 
responses. The displayed data are not consistently related to the pilot's in p ut s (R e f g\ 
Arbitrary delays, spatial separation of cause and effect, and discrete, discontinuous 
subsystems tend to obscure cause-effect relationships. The pilot is insulated from the 
aircrat and develops a completely different image of the system he is operating than he 
would if the computers were not there. Consequently, any failure of the computers (either 
due to electromechanical failure or an unexpected situation) requires the pilot to intervene 
in a system with which he is not currently familiar 

Intervention is further complicated by i na dequate feedback to the operator about system 
status for timely diagnosis should an off-nominal situation occur. (Ref 9) Consider, for 
instance, the case of the race car that was equipped with the latest automatic compensation 
for brake failures. When it suffered a failure in one brake, the system automatically 
compensated, just as it was designed to do. Shortly after, a second brake failed, and, due 
to the increased loading caused by the compensation system, the third-brake failure quickly 
followed the second. But, the automatic compensation system had done its job so well that 
it was not until the fourth brake failed that the driver realized he had a problem. This might 
make a humorous anecdote except for what happened to the driver and the fact that there are 
several examples of similar incidents occurring in aviation. Consider the case of the Chin^ 
Airlines 747 accident in 1985 which experienced a gradual loss of power from its outer 
right engine. The autopilot compensated for the increasing tendency to yaw until it fi nall y 
reached the limit of its compensatory abilities and could no longer keep the plan* s table. At 
this point, the crew did not have enough time to determine the cause of the problem and to 
take action. More recently, a failed fuel pump on an A320 caused a gradually increasing 
unbalance that was quietly and efficiently compensated by the autopilot with no indication 
of a problem to the crew. 

Recently, aircraft designers have begun to look at incorporating more and more 
"intelligence" into the automated systems as ways of augmenting (or replacing) human 
capabilities and, thereby, reducing the potential for human error. Artificial intelligence, 
decision-aiding systems, knowledge-based systems, and expert systems became the "buzz 
words of the eighties. Today, we are considering proposals for military aircraft with one 
human pilot supported by several electronic crew members. I recommend a considerable 
dose of caution. While knowledge- based and expert systems have found some limited 
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applicarions in the control of physical plants, manufacturing processes, and quality control, 
the majority of these systems have fallen short of the promise of competent performance. 
(Ref 10) While these systems can take over control that used to be done by people, they 
are not able to handle all abnormalities, nor are they able to provide the continual, 
appropriate communication with a human partner that occurs naturally among H uman team 
members. 

A large part of the problem is that technically complex and sophisticated systems continue 
to be designed assuming the human operator will provide all the adaptive control and 
integration required for effective operation. The systematic consideration of human 
cognitive performance characteristics and limitations is not typically a part of the design of 
the aircrew station. There is little evidence that anyone has analyzed the role of the modem 
flight crew and designed the cockpit, the instrumentations, the procedures, and the controls 
around that role. The aerospace c ommuni ty still treats h uman er r or as a t raining or 
discipline problem, not as a sign of poor design or inappropriate procedures. (Ref 1 1) 
Bainbridge says " the designer who tries to eliminate the operator still leaves the operator to 
do the tasks which the designer cannot think how to automate". (Ref 12) The tendency to 
exploit that which is technologically feasible, leaves to the h uman pilot not only those tasks 
which have escaped automation, but also whatever new tasks are generated as a 
consequence of automation, frequently, such systems only work in die most benign 
environments. Wiener has called such designs "clumsy" antnmaiinn, but they are clumsy 
because they have not taken proper account of the characteristics of the human operator. 
(Ref 13) 

We have learned that the new errors created through the current philosophy of design of 
automation can, in fact, be worse than the types of errors alleviated through au tomatin g 
Egan found that there are dramatically greater individual differences in the performance of 
computer-mediated tasks, and suggests that most of the difference is due to a larger number 
of more costly erro r s inherent in computer tasks. (Ref 14) 

While automation conveys very significant benefits, the aviation community clearly 
perceives in automation a potential threat to air safety. (Ref 15) Questions are beginning to 
emerge about the respective roles of humans and the new technology. Anecdotal reports of 
problems with automated systems are abundant, and mosdy these have not been the results 
of failure in machine reliability, but rather of failure of information management and 
communication between the machine and the human operator. 

The evidence of problems of human interactions with advanced cockpits has become so 
pervasive that the new US National Plan for Aviation H uman Factors assigns highest 
priority to encouraging the development of "human-centered" design for automation and 
recommends the development of procedures for evaluating human factors issue s early in 
the development of every major system. Also, the human factors problem has been 
recognized as cutting across all elements of the aviation system where the system 
encompasses the flight deck, the training, the operating procedures, the air traffic control 
system, the maintenance environment, die system designers, and the systems integration. 
(Ref 16) 

A lack of understanding of and appreciation for the characteristics, needs, and limitations of 
human performance and behavior manifests itself today as mistake in the designs of flight 
deck displays and controls, unrealistic procedures, excessive training costs, and a challenge 
to human adaptability. (Ref 17) The capability to model, structure, and analyze the human 
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components of complex and interactive man-machine systems, has not kem Dace with the 

zests 2*5 ^i°pi vanc ' d ^ hnoi ° s ' *»*“■ ss scr 

h w ™ ther ^ e c ^"‘ 5SSS ,k " 1 

human adaptabihty will suffice for designing the systems of the SEI missions. 


IV. TOMORROW 

Sy u Stems **“* ^ rcly on integrating automated and robotic machines 
th humans permeate the arenas of vehicle maneuvering* vehicle serviHna in ««>/»•• ; 

space and surface assembly and construction; planetary rovers* extravehicular auiviiv and 
exploranon; sample acquisition, analysis, and^se^n^StifcStes an? 
penetrators. Humans will need to interact reliablv safelv and 

machines durin S inspection, assembly, checkout, operatimu nM^nMce”’ 
repair, and emergency intervention in order to perform the tasks of the r*r»lnrj»rinn * 
missions. The SEI missions will rely on intend in^SSs^S ta££ and 
machmesto an extent that is seldom encountered on Earth. To achieve the objectives of the 
Mission from Planet Earth, we are faced with the problem of designing a variety of svstems 

reliew^^Vs SSSrffioS 11 °Q S ^ aCC °L ftB NationaI Council, in its 

Mars (November 1989), identified “Explo^tio^Hu^^^re^^tiS E^^on 

0 L^”- 7,16 “ Revicw of NASA’s 90-Day Study andSStivS** 
published by the National Academy Press (1990) states that: * ternatlves 

“Mechaniccdand computer-aided extensions of human (astronaut) managers can orovide 

Th^mn^t ln lnspe f tion ’ assembly, maintenance, repair, and exploration tasks 
e most powerful approaches to human exploration will integrate humans with machine 
systems to accomplish more than either can do alone . 

‘rea ^^Sf. mtem enabling te dmoloeL bm. a 

. smrement (ql practiccil HEl operations. . Technical advances can extend profoundly the 
human role as master of highly flexible human surrogates, but obMngsmhZe^M 

bT^n^lh/onlf) 6 TJl than r° m P lex robotr y and automation. NASA presentations 
based on the 90-Day Study implicitly recognize this by grouping operations in functional 

categories. Systems that integrate automation and robotics with humans permecuethe arenas 
of vehicle maneuvering; vehicle servicing in space; in-space and surface assembly and 
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construction; planetary ravers; surface operations; extravehicular activity and exploration • 
sample acquisition, analysis, and preservation; and scientific probes and penetrators 

The recent Report of the Advisory Committee on the Future of the U.S. Space Program 
(the Augustine Committee report) also addressed these concerns. (Ref 18) While it does 
not specifically speak of Human Factors, there are statements regarding Life Sciences in 
most of the programmatic recommendations that clearly imply concerns for the behavioral 
and psychologica 1 , as well as the physiological, well being of the astronauts. The report of 
the Synthe^s Group titled America at the Threshold" specifically recognizes the criticality 
o uman Factors, and the need to design equipments and machines for compatibilty with 
human operators. (Ref 19) J 


So far, our approach to designing automated systems with which humans must interact has 
not been entirely satisfactory. Currently, the functional requirements for complex systems 
rarely specify even the information needed by the human operator to perform the task. (Ref 

20) We shall be unable to implement rational designs for the systems we need to 

accomplish the SEI missions with assurance of safe and reliable human-system 

performance without an understanding of how to combine human and automated systems 
criccuvciy* 


Designs for effective human -computer interactions are further complicated by the effects of 
long-duration missions in space. We do not yet know the effects on crew performance of 
long-term isolation and confinement, or of long-term exposure to zero/micro/partial gravity 
or to artificial gravity. We do know that long periods of low-level interaction can result in 
decreased system productivity due to monotony and boredom of the human operator We 
do not know how to keep crew members highly skilled at complex tasks that they seidom 
. e X cr> * iavc perfonn. The impact of automation on crew performance in ter ms of 

vigilance, readiness, and the ability to handle system breakdowns and failur es are not well 
understood. The most important functions aboard present day and projected spacecraft 
involve diagnosis and decision making, and our greatest gap in knowledge currently in task 
retention is in understanding the retention of diagnostic and decision-making skills. All of 
these factors must be taken into account in designing the systems with which the S El- 
mission crews will interact. (Ref 21) 


Also, the human-machine systems for the SEI missions must be designed according to a 
philosophy of human-centered automation because the effective authority and responsibility 
x?a ?* sslon success will rest with the crew. For the foreseeable future, it is unlikel y that 
NASA would tolerate the fielding of a system that is capable of effectively overruling a crew 
member. Moreover, the human crew will demand that final authority. Automated systems 
will provide support for die crew’s performance of critical tasks and must be designed to 
enable m a xim u m flexibility in the crew’s selection between complete automation and 
complete manual control in the performance of a given task, and so the problem area is that of 
partial automation. 


Unfortunately, we have little appreciation of either the potential or the limitations of close- 
working relationships between humans and complex, automated machines, or of how these 
interactions affect relations with other crew members or total crew performance. We do not 
know how to design a complex, automated machine in such a way that it will fit naturally 
mto a human organization. (Ref 17) We do not, at the present time, have a r ationa l, 
predictive methodology for system design by which the developer of the artificial 
intelligence subsystem can integrate human-factors principles with other system-design 
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However, there is another intriguing subset of this third category which will occur when 
we accept that the human may not always be the most competent decision maker, and when 
the correct perception of the state of the world may only reside with the machine member of 
the team A system in which human users can override the machine partner compromises 
the goal of developing truly cooperative human-machine systems. A joint cognitive system 
implies a productive relationship between the knowledge of the machine and that of the 
human in which the different points of view are integrated in the decision process. 

Someday, we may consider the case when the human is no longer the sole supplier of the 
initiative, the direction, the integration, and the standards. We may accept that the safest 
and most efficient system is one that incorporates considerable duplication or 
interchangeability of functions among its human and non-human crew members and thus 
benefits from the strengths of both. However, I do not foresee acceptance of this concept 
within the life of the SEI program, and so I limit myself to developing the philosophy for 
the human-centered design of partially automated subsystems that fall into the third 
category described above. 

The assumption that all critical decisions during the SEI missions will be left to the 
judgment of the human member of the team, has considerable significance to the designs of 
subsystems in the third category. Error-free operations by humans is impossible. Cicero 
said "It is in the nature of man to err". However restrictive is the crew-selection process 
and however much is invested in training and checking, there will still be residual human 
errors. Consequently, even though the human will be assigned responsibility for all the 
critical decisions, we must accept the inevitability of human error and we must design the 
system to minimize the consequences of these remaining errors. (Ref 7, 15) Furthermore, 
the system hardware must not make it difficult for the human to assume these 
responsibilities. There is no point in relying on the real or imagined virtues of human 
flexibility and innovation if the man-machine interface is so restrictive that the controller is 
unable to be either flexible or innovative in the actions which the system allows him to 
initiate. The objectives of a human-centered design should be to support h um a ns to achieve 
the operational objectives for which they arc responsible. The human role must be treated 
as central and the machine must be used to assist the human in achieving his goals rather 
than to supplant him. Consequently, the first question to be asked in a human-centered 
design philosophy is "In this situation, what is it that we expect the human to be able to 
do?", followed by the question "What information and control must he have in order to do 
it?" ’ 

Even with the imposition of the human-centered constraint on the design, thinking of 
humans and machines as working together as a total system is an appropriate orientation 
toward system design for CASE 3. Dr. Jane Malin at the NASA Johnson Space Center has 
called this "making intelligent systems team players". (Ref 26, 27, 28) My colleague at 
Ames, Dr. Mary Connors, has used the term "crew system" to include all active, intelligent 
flight participants, both human and automated; and the term "crew system dynamics" to 
describe all activity of these members, both alone and in combination. (Ref 21) The 
Committee on Human Factors of the National Research Council (Ref 16) has said that "A 
system is any identifiable set of mutually influential entities associated for the purpose of 
producing desired changes in the attribute state of objects" I propose that we view the 
systems of CASE 3 in this context as being composed of teams of human and non-human 
entities, in contrast to prevalent concepts of design that consider only die non-human 
entities and exclude the human entities. (Ref 29) The mutual influences among the entities 
constitute interactions, and system effectiveness is concerned with optimizing these 
interactions, rather than the individual behaviors, except as there are behavioral limits on all 
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entities. This approach recognizes that, just as in a team of human performers, proficiency 
of the individual endues does not assure proficient and effective team or system 
performance. (Ref 7,8) 

Currently, the problem of the human-computer interaction is often considered to be merely 
one of interface design. In the case of the partially automated systems in CASE 3 that rely 
on interactive cooperation, this viewpoint is no longer appropriate. Interface design 
corresponds to playing with the language when the problem that interferes with 
communication of information and understanding is that humans come from a "culture" that 
is totally different from that of the non-human intelligence. Differences in the processes of 
problem solving and decision making are deeply rooted in die respective traditions and 
cultures of humans and machines. Machines do not sense data, process it, solve problems, 
make decisions, learn from experience, or take actions the way humans do. Mac hin e logic 
is not the same as human logic. In fact, not everything that humans do is completely 
logical. It is easy to accept that a non-human intelligence cannot be expected to understand 
a human. It is equally true, even if not so obvious, that a human cannot be expected to 
understand a non-human intelligence. (Ref 30, 31) Without a doubt, improperly designed 
interfaces will interfere with understanding, but even the most elegantly designed interface 
will not assure understanding under all circumstances. One cannot simply b uild an 
automated system and then overlay it with interface features, and expect to achieve 
understanding between the human and the machine. (Ref 25) 

A well-executed interface design is a necessary, but not a s ufficient , condition for 
cooperation. The objective of interface design is simply to put the Ham in the mode (Le., 
visual, auditory, tactile, etc) and the format (Le., alph anu meric, iconic, clock dials, 
thermometer tapes, color, font, size, location, etc) to maximize the likelihood that the 
human can translate the data displayed into information. (It is not information until it is 
perceived as such by the observer. The display designer cannot declare that his display is 
information, because the act of informing does not guarantee a state of being informed.) 
Interface design has little to do with ensuring that the information is necessary and 
sufficient for the human to understand the state of the system. (Ref 9, 17) Unless 
observers can effectively decode the representation to extract relevant information (as 
defined individualist! cally by the observer), the representation will fail to support the user. 
Most of the research on human-computer interface design is limited to studying the changes 
in the "language" that may be necessary for understanding, rather than on the dete rmination 
of what is sufficient for understanding. As Mars hall has stated it, there is a c ommo n 
perception that human factors specialists "...should be brought in to sprinkle magic dus t 
on the interface or workstation once it is largely developed". (Ref 32) The danger of 
focusing on dungs like icon shapes and colors or pull-down menu s rather than the more 
fundamental issue of whether the appropriate information is bong t ransf erred is dismissed 
by Woods and Eastman. (Ref 33) 

The process by which a human translates his psychological representations of the system 
state, his goals, and his intentions into physical actions en tails a good deal more than 
extracting information from his sensor inputs. To perform a particular task, the h uman 
selects and recognizes patterns representing the system state, integrates the inp ut s to all of 
his sensors, relates the integrated inputs to his preconceived representations, decides what 
further information he needs and acquires it, infers what this information implies, adds his 
own previous knowledge about the actual and potential states of the situation and his own 
value structure, biases, and emotions, predicts what will happen next, and considers 
actions to produce the desired state in order to arrive at the appropriate decisions. To 
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6. Flexible; Le., should enable a range of control and management options from 
direct manual to autonomous. 

7 . Dependable; i.e., do what it is ordered to do, never do what it is not ordered 
to do, and never make the situation worse, but, as perfection is impossible, it 
must also be 

8 . Informative; i.e., keep the pilot well informed about what is going on. 

9. Error resistant; i.e„ keep the pilots from making errors, but, at the same time, 
recognizing that this is not always possible, it must also be 

1 0. Error tolerant; i.e., detect and mitigate the effects of pilot errors. 


All of these "attributes" can be related to the characteristics that the Ames researchers have 
found to be important to effective human-to-human communication. 


In this design philosophy, both the machine and the human are viewed as information- 
processing systems capable of independent, complex behavior. In order to ensure reliable 
coordination, we will need to understand the processes of cognition of both entities and the 
processes of information transfer needed to achieve compatibility. (Ref 5) For the human 
members of the crew, the solution to the problem of ensuring effective coordination and 
communication is a matter of proper selection, training, and organizational management; 
for the non-human member, it becomes a matter of proper design. 


VI. A POSSIBLE APPROACH 

Simulation has become an important tool for investigating the behavior of complex systems 
during conceptual and preliminary design. However, the analysis of system performance 
through simulation requires efficient and effective representations of significant parameters 
of interaction among its entities. The designer/analyst must have the ability to examine and 
manipulate component models. Therefore, to make effective use of simulation during 
preliminary design of the SEI human-machine systems, we need, in addition to the usual 
models of the equipments and environments, a model of the human activities, a model of 
the racks to be accomplished and of the role that the human is expected to play in 
accomplishing those tasks, and a model of the human capabilities, limitations, and needs to 
play that role. (Ref 5) 

I am not suggesting that we will realize a true computational emulation of the human brain 
in the near future. We are only at the most elemental levels of understanding the 
relationships between the human mind and behaviors and the biological structures and 
electrochemical processes of the brain. We are far from implementing the 
neurophysiological mechanisms in symbolic processors or connectionist networks to 
emulate the human cognitive and perceptual system. 

For the present, however, we can settle for a good deal less. In order to be able to address 
human factors issues during the conceptual design stages of missions and systems, we 
need engineering human performance models. with which we can examine, at least, the 
first-order effects of the complementary contributions of human and machine to a system. 
Professor Gerlach already addressed this need in 1986 in his biomarphic model of the 
physiological and psychological processes in a human in a single-display, single-axis 
control situation. (Ref 39) 
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Even though we cannot emulate the human brain, there is considerable promise for an 
adequate model to simulate the way in which a human mi ght or could act in a particular 
situation. For instance, we have recently seen some great improvements in anthropometric 
modeling that promise to meet adequately one of the requirements for model-based h uman 
engineering. Today, we have extremely elegant anthropometric models of easily created, 
realistic, and physically quantifiable human-figure motion via an interactive computer 
graphics system. The designer is able to select h uman figures of different sizes that include 
die 5th, 50th, and 95th percentile male and female, based on NASA astronaut 
demographics. These figures can be placed within a three-dimensional object environment 
that can be created and stored. Joint limitations have been install^ to eliminate 
unreasonable movements, and kinematic and inverse kinematic controls are applied so that 
goals and constraints may be used to position and orient the figure with extemal/intemal 
forces and torques applied to produce motion. Key poses can be stored and interpolated 
for animation, allowing environmental limitati ons to be detected as a function of human size 
and movement characteristics. Recent developments include a new 17-segment vertebral 
column for very realistic torso movements, pr eliminar y c ollision detection/avoidance 
mechanisms, and new figure definitions based on detailed stereo-scanned images fr o m 
several somato types in each gender. In addition, by attaching the "view" of the 
environment to the mannequin's eye, the program displays a perspective correspo ndin g to 
what the mannequin would "see" while moving in the environment, providing the first step 
toward further analysis and conclusions about object occlusion and visibility. We are 
currently using this model in the Man-machine Integration Design and Analysis System 
(MIDAS) being developed at Ames in collaboration with the US Army. (Ref 40, 41) Our 
colleagues at the NASA Johnson Space Center are acc umulatin g the data to extend the 
strength and motion characteristics of these models far use in micro-gravity simulations. 
With models like these we can begin to address some of the ergonomic issues of design. 

More recently, we have begun developing computational methods fir describing and 
analyzing cognitive tasks comparable with the methods we have for analy sin g physical 
tasks. Considerable progress is being made in the new field of cognitive science where 
mechanistic models of humans performing complex perceptual, cognitive, and motor tasks 
are under development that may allow us to go beyond the descriptive approach of 
traditional experimental psychology. Current research at NASA Ames on computational 
modelling of human perception and cognition represent some encouraging attempts to 
describe how humans accomplish various mental tasks. 

The Cognition Simulation System (CSS) being developed by my colleagues at Ames is just 
one representative study. (Ref 42) The CSS is a software system intenHaH to aid 
researchers in designing and evaluating models of human cognition by providing an 
interactive, graphics-based simulation environment CSS is a discrete-event simulation 
system specialized for simulating distributed, partly parallel, partly serial processing 
systems, like those typically hypothesized to underlie human information processing. CSS 
can be used more generally to model any distributed system, and incorporates some of the 
power of production systems. CSS has been used to date to model the role of human 
attention in visual information processing, to model the delays imposed by doing two tasks 
at once, and to model the flow of information during preparation for launch between the 
NASA Test Director at the Kennedy Space Center and his various external information 
sources and equipment 

One important focus of interest at our Aerospace Human Factors Research Division is the 
integration of these CSS models into the MIDAS architecture. The Symbolic Operator 



- 24 - 


Model (an element of the MIDAS) models h uman perceptual processes, cognitive 
processes, and response/effector processes using an integrated object-oriented architecture. 
This model also provides a limited description of h uman neuromotor response and verbal 
communication protocols. MIDAS includes the computational structures and utilities 
required to support the modeling environment and knowledge-base through which these 
components interact, including an updateable world representation, activity/procedural 
representation, and rules and decision methods which guide operator behavior in selection 
among several contingent procedural paths and are responsive to the current mission 
context 

Construction of useful, integrated, mechanistic, engineering models of human performance 
now seems possible. However, these studies have, so far, been limited to modeling single 
individuals. We are moving toward explicit attacks on the problem of how individual 
cognition interacts with perceptual, physiological, and group factors. We need now to 
begin to consider communications between such models and to factor into these new 
models those elements that we have found important to transfer of information and 
coordination. The agent architecture of the computational models we have developed not 
only enables us to modify any of the components easily, but also is particularly suited to 
studying an intermix of human and non-human agents. 

Validation of our computational models is essential, but extremely difficult A fundamental 
problem of all Human Factors research is that the tools and theories that have been 
developed in highly simplified and controlled laboratory environments arc of little 
assistance in understanding human behavior in the complex and varied environment of 
aerospace operations. 

Another major difficulty in trying to build predictive models of human behavior is the fact 
that behavior is often influenced by knowledge and emotions of which the actor is totally 
unaware. Perceptual-cognitive functions such as discriminative response to s timulatio n, 
perception, memory, information processing, complex cognitive activity devoted to stimuli 
that arc themselves outside of awareness, and the higher-order mental processes involved 
in judgment or problem-solving can all take place outside of phenomenal awareness and 
can affect action. Realistically, we may never be able to find reliable, validated, predictive 
models of systems in which human beings participate except in limited do mains 

Nevertheless, with the continued development and validation of these models, we expect to 
use them in simulations to develop guidelines for designs of missions, operations, anrl 
procedures, as well as automated systems. 


VII. CONCLUSIONS 

One day, the intelligence of a computer may rival that of the h uman brain. One day, we 
may learn how to couple human brains and computing machines in truly cooperative 
partnerships. For now, however, we must continue to rely on h uman intelligence, 
judgment, flexibility, creativity, and imagination in dealing with unexpected events, while 
complementing these with machine capabilities for logic, speed, persistence, consistency, 
and exactitude. 
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Our current situation cnes out for cooperative research as there does not exist in any one 
nation sufficient resources in either expertise or money to solve these problems in a 
reasonable time. I feel a sense of urgency, because while we arc still struggling with the 
science to understand the problems, the engineering community is spending a great deal of 
money designing the solutions. * 
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